diff --git a/patches.suse/mm-pagewalk-Fix-race-between-unmap-and-page-walker.patch b/patches.suse/mm-pagewalk-Fix-race-between-unmap-and-page-walker.patch
new file mode 100644
index 0000000..d21e2e9
--- /dev/null
+++ b/patches.suse/mm-pagewalk-Fix-race-between-unmap-and-page-walker.patch
@@ -0,0 +1,94 @@
+From: Steven Price <steven.price@arm.com>
+Date: Fri, 2 Sep 2022 12:26:12 +0100
+Subject: mm: pagewalk: Fix race between unmap and page walker
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Git-commit: 8782fb61cc848364e1e1599d76d3c9dd58a1cc06
+Patch-mainline: v6.0-rc4
+References: git-fixes, bsc#1203159
+
+The mmap lock protects the page walker from changes to the page tables
+during the walk.  However a read lock is insufficient to protect those
+areas which don't have a VMA as munmap() detaches the VMAs before
+downgrading to a read lock and actually tearing down PTEs/page tables.
+
+For users of walk_page_range() the solution is to simply call pte_hole()
+immediately without checking the actual page tables when a VMA is not
+present. We now never call __walk_page_range() without a valid vma.
+
+For walk_page_range_novma() the locking requirements are tightened to
+require the mmap write lock to be taken, and then walking the pgd
+directly with 'no_vma' set.
+
+This in turn means that all page walkers either have a valid vma, or
+it's that special 'novma' case for page table debugging.  As a result,
+all the odd '(!walk->vma && !walk->no_vma)' tests can be removed.
+
+Fixes: dd2283f2605e ("mm: mmap: zap pages with read mmap_sem in munmap")
+Reported-by: Jann Horn <jannh@google.com>
+Signed-off-by: Steven Price <steven.price@arm.com>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Cc: Konstantin Khlebnikov <koct9i@gmail.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
+---
+ mm/pagewalk.c |   13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/mm/pagewalk.c
++++ b/mm/pagewalk.c
+@@ -36,7 +36,7 @@ static int walk_pmd_range(pud_t *pud, un
+ 	do {
+ again:
+ 		next = pmd_addr_end(addr, end);
+-		if (pmd_none(*pmd) || !walk->vma) {
++		if (pmd_none(*pmd)) {
+ 			if (walk->pte_hole)
+ 				err = walk->pte_hole(addr, next, walk);
+ 			if (err)
+@@ -81,7 +81,7 @@ static int walk_pud_range(p4d_t *p4d, un
+ 	do {
+  again:
+ 		next = pud_addr_end(addr, end);
+-		if (pud_none(*pud) || !walk->vma) {
++		if (pud_none(*pud)) {
+ 			if (walk->pte_hole)
+ 				err = walk->pte_hole(addr, next, walk);
+ 			if (err)
+@@ -247,7 +247,7 @@ static int __walk_page_range(unsigned lo
+ 	int err = 0;
+ 	struct vm_area_struct *vma = walk->vma;
+ 
+-	if (vma && is_vm_hugetlb_page(vma)) {
++	if (is_vm_hugetlb_page(vma)) {
+ 		if (walk->hugetlb_entry)
+ 			err = walk_hugetlb_range(start, end, walk);
+ 	} else
+@@ -310,9 +310,13 @@ int walk_page_range(unsigned long start,
+ 		if (!vma) { /* after the last vma */
+ 			walk->vma = NULL;
+ 			next = end;
++			if (walk->pte_hole)
++				err = walk->pte_hole(start, next, walk);
+ 		} else if (start < vma->vm_start) { /* outside vma */
+ 			walk->vma = NULL;
+ 			next = min(end, vma->vm_start);
++			if (walk->pte_hole)
++				err = walk->pte_hole(start, next, walk);
+ 		} else { /* inside vma */
+ 			walk->vma = vma;
+ 			next = min(end, vma->vm_end);
+@@ -330,9 +334,8 @@ int walk_page_range(unsigned long start,
+ 			}
+ 			if (err < 0)
+ 				break;
+-		}
+-		if (walk->vma || walk->pte_hole)
+ 			err = __walk_page_range(start, next, walk);
++		}
+ 		if (err)
+ 			break;
+ 	} while (start = next, start < end);
diff --git a/series.conf b/series.conf
index 5b0b46d..865506e 100644
--- a/series.conf
+++ b/series.conf
@@ -23150,6 +23150,7 @@
 	patches.suse/net_sched-cls_route-disallow-handle-of-0.patch
 	patches.suse/af_key-Do-not-call-xfrm_probe_algs-in-parallel.patch
 	patches.suse/mm-rmap-Fix-anon_vma-degree-ambiguity-leading-to-double-reuse.patch
+	patches.suse/mm-pagewalk-Fix-race-between-unmap-and-page-walker.patch
 
 	# netdev/net
 	patches.suse/netfilter-nf_conntrack_irc-Fix-forged-IP-logic.patch